Technical impact
A use‑after‑free flaw exists within the JavaScript handling of PDF annotations in Foxit PDF Editor and Reader. During reentrant page‑event processing, the software releases a page object that is later accessed again, resulting in an application crash. The description indicates a denial‑of‑service effect; however, the CVE title explicitly claims a remote code execution vulnerability, suggesting that the use‑after‑free could be exploited to execute arbitrary code, although the description does not detail such a path.
Affected Systems
Both Foxit PDF Editor and Foxit PDF Reader from Foxit Software Inc. are affected. No specific product versions are listed in the available data, so all installations of these applications are potentially vulnerable until a patch is applied.
Risk and Exploitability
The CVSS score of 7.8 indicates a high severity, and the EPSS score of less than 1% shows that the exploitation probability is very low but not zero. The vulnerability is not listed in CISA KEV, implying it is not yet a known exploited issue. The attack vector is not explicitly documented; based on the description the flaw can be triggered by providing a malicious PDF to the application, but the exact conditions and potential for denial‑of‑service or remote code execution remain unspecified.
